CVE-2019-14798

MEDIUM 4.9CVE-2019-14798 · Published 09/08/2019 · updated 17/06/2026

In short

CVE-2019-14798 is a MEDIUM (CVSS 4.9) vulnerability affecting photo gallery (10web).
Chance of exploitation in the next 30 days (EPSS): 4.4%, higher than 91.4% of all vulnerabilities.
Fix: update to 1.5.25 or later.

Package	Affected versions	Patched versions
photo gallery 10web	`< 1.5.25`	`1.5.25`

Description

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.

References

wordpress.org/plugins/photo-gallery · Third Party Advisory
wpvulndb.com/vulnerabilities/9361 · Third Party Advisory
pluginvulnerabilities.com/2019/05/14/authenticated-local-file-inclusion-lfi-vulnerability-in-photo-gallery-by-10web · Exploit

More vulnerabilities in photo gallery

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

photo gallery

10web

< 1.5.25

1.5.25

More vulnerabilities in photo gallery

See all →